CVE-2022-43571

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 8.1, < 8.1.12; >= 8.2, < 8.2.9; >= 9.0, < 9.0.2

References

https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/Exploit, Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.htmlVendor Advisory
https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/Exploit, Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.htmlVendor Advisory

Timeline

Published: Nov 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-435726.5In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Coll CVE-2022-435735.3IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform lev CVE-2022-435747.5"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allo CVE-2022-435755.4IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr CVE-2022-435785.4IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This CVE-2022-435795.4IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This CVE-2022-43587.2The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, CVE-2022-435818.8IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to miss CVE-2022-435885.5A null pointer dereference vulnerability exists in the handle_ioctl_83150 functionality of Callback technologies CBFS Filter 20.0.8317. A sp CVE-2022-435895.5A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Filter 20.0.8317. A sp CVE-2022-43597.2The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, CVE-2022-435905.5A null pointer dereference vulnerability exists in the handle_ioctl_0x830a0_systembuffer functionality of Callback technologies CBFS Filter